HTTP response splitting in axios - CVE-2026-42035

Detailed vulnerability description

The vulnerability allows a remote attacker to inject arbitrary HTTP headers into outgoing requests.

The vulnerability exists due to improper neutralization of CRLF sequences in HTTP headers in lib/adapters/http.js when processing data payloads in HTTP requests after a polluted object prototype causes plain objects to be treated as FormData instances. A remote attacker can pollute Object.prototype so that an attacker-controlled getHeaders() function is invoked to inject arbitrary HTTP headers into outgoing requests.

Exploitation requires a prototype pollution primitive somewhere in the application's dependency chain and the application must use Axios to send requests with a data payload such as POST, PUT, or PATCH.

How to mitigate CVE-2026-42035

Sources

• https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9